JP2019102023A - System and method - Google Patents

Abstract

To provide a system for security monitoring capable of monitoring an attack on an information processing device for an object having a plurality of information processing devices.SOLUTION: The system includes: a movable body log DB 11 for storing logs generated in each of a plurality of information processing devices belonging to one or more objects by being acquired from each of one or more objects through a second network different from a first network; an analysis support information DB 13 for storing analysis support information on each of the plurality of information processing devices belonging to the one or more objects; and an attack determination device for determining whether each of two or more logs is an attack on an information processing device corresponding to each of the two or more logs by collating the two or more logs about one object stored in the movable body log DB 11 with analysis support information stored in the analysis support information DB 13 and related to the plurality of information processing devices belonging to one object, and outputting a determination result.SELECTED DRAWING: Figure 2

Description

  The present disclosure relates to systems and methods, and more particularly to systems and methods for security monitoring.

  In recent years, in mobile bodies such as automobiles, a plurality of information processing apparatuses capable of electronically controlling actuators such as an accelerator, a steering wheel, and a brake are connected to a mobile body network. Moreover, in such a mobile unit, external connection such as 3G data communication has become possible.

  For this reason, there is a possibility that the moving object may be an attack target of a hacker, such as controlling the moving object with an interface for external connection as an intrusion port.

  On the other hand, there is a technique for collecting event logs such as communication logs in an in-vehicle network (for example, see Patent Document 1). Then, by presenting information collected to the event log to an analyst, there is considered a security system for grasping a threat event based on them (SIEM: Security Information and Event Management).

JP, 2017-192082, A

  However, with the collected event log alone, the analyst may determine whether it is a hacker attack on the moving object and the object conforming to the moving object, a mere failure of the device, or an erroneous operation of the user. There is a problem that it can not do.

  The present disclosure has been made in view of the above-described circumstances, and provides a system and method for security monitoring capable of monitoring an attack on an information processing device of an object having a plurality of information processing devices.

  In order to achieve the above object, a system according to an aspect of the present invention is a security monitoring system for monitoring an attack on an information processing device of one or more objects having a plurality of information processing devices connected by a first network. A log generated by each of a plurality of information processing apparatuses possessed by the one or more objects by being obtained from each of the one or more objects via a second network different from the first network. Storing analysis support information related to each of the plurality of information processing apparatuses, which is analysis support information used to determine an attack on each of the plurality of information processing apparatuses included in the one or more objects; A second storage device, two or more logs of an object stored by the first storage device, and the second storage device Information supporting apparatus corresponding to each of the two or more logs by comparing the analysis supporting information corresponding to the plurality of information processing apparatuses included in the one object. And an attack determination device that outputs a determination result.

  According to this configuration, it is possible to determine whether or not an attack has been made via a plurality of information processing devices included in one object, so monitoring attacks on an information processing device of an object having a plurality of information processing devices can do.

  Here, for example, the analysis support information at least includes design information on each of the plurality of information processing apparatuses.

  Also, for example, the analysis support information may further include specifications of each of the one or more objects and a state of each of the one or more objects.

  Also, for example, the analysis support information is configured to include an occurrence condition of an event described in each of the two or more logs and determination information indicating a condition for identifying whether the occurrence condition is correct or not. It is also good.

  Also, for example, the attack determination device extracts information for determining whether or not the condition indicated in the determination information is satisfied from each of the two or more logs, and contrasts with the determination information. It may be determined whether it is an attack.

  Also, for example, the attack determination device extracts a feature from each of the two or more logs, and uses the extracted statistical information of the feature as the information to make the determination, so that each of the two or more logs Information may be extracted.

  Also, for example, the attack determination apparatus extracts analysis support information on an information processing apparatus corresponding to each of the two or more logs from the analysis support information stored in the second storage device, and the two or more logs And the extracted analysis support information, the two or more logs are displayed depending on whether the event indicated in each of the two or more logs is an event that occurs in design in the corresponding information processing apparatus. It may be determined whether it is an attack on the information processing apparatus corresponding to each of the above.

  Also, for example, when the attack determination device determines that one or more of the two or more logs is an attack on an information processing device corresponding to the one or more logs, the two or more logs If it can not be determined that at least one of the logs is an attack on the information processing apparatus corresponding to the at least one log, the at least one log is an attack on the information processing apparatus corresponding to the at least one log. It may be estimated that there is.

  Also, for example, when the attack determination device determines that each of the two or more logs is an attack on an information processing device corresponding to each of the two or more logs, the determined attack content; An attack scenario display generation device for generating an attack scenario display screen which is a display screen for displaying the time at which each of the two or more logs is generated at a position corresponding to the two or more logs; The device may output the generated attack scenario display screen on the display.

  Also, for example, the attack scenario display generation device may set, as the attack scenario display screen, the first network in which the one object has the determined attack content and the time at which each of the two or more logs is generated. The display screen associated with the position of the corresponding information processing device may be output from the object network configuration diagram showing the plurality of information processing devices connected in step b.

  Also, for example, the attack scenario display generation device may use the determined attack content and an information processing device corresponding to each of the two or more logs as the attack scenario display screen, respectively, for each of the two or more logs. The display screen displayed in chronological order may be output for each time when the event occurs.

  Furthermore, for example, the attack determination device and the one or more objects may be further connected by the second network.

  Note that these general or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer readable CD-ROM, and the system, the method, the integrated circuit, the computer It may be realized by any combination of program and recording medium.

  According to the system and method of the present disclosure, an attack on an information processing device of an object having a plurality of information processing devices can be monitored.

FIG. 1 is a diagram showing an outline of a system according to an embodiment. FIG. 2 is a diagram showing an example of a functional configuration of a system according to the embodiment. FIG. 3A is a diagram showing an example of a functional configuration of a mobile unit according to the embodiment. FIG. 3B is a diagram showing an aspect of the mobile shown in FIG. 3A. FIG. 4A is a diagram showing an example of a log transmitted by the mobile unit according to the embodiment. FIG. 4B is a diagram showing an example of a log transmitted by the mobile unit according to the embodiment. FIG. 5 is a diagram showing an example of a functional configuration of the attack analysis device according to the embodiment. FIG. 6 is a diagram showing an example of analysis support information extracted by the attack determination unit according to the embodiment. FIG. 7A is a diagram showing an example of an attack scenario display screen generated by the attack scenario display generation unit according to the embodiment. FIG. 7B is a diagram showing an example of an attack scenario display screen generated by the attack scenario display generation unit according to the embodiment. FIG. 8 is a diagram showing an example of analysis support information stored in the analysis support information DB according to the embodiment. FIG. 9 is a diagram showing an example of an attack log stored by the attack log DB according to the embodiment. FIG. 10A is a diagram showing an aspect of an attack scenario display screen displayed on the display device according to the embodiment. FIG. 10B is a diagram showing an aspect of the attack scenario display screen displayed on the display device according to the embodiment. FIG. 11A is a diagram showing analysis support information used to estimate the attack determination content of the attack scenario display screen shown in FIG. 7A. FIG. 11B is a view showing analysis support information used to estimate the attack determination content of the attack scenario display screen shown in FIG. 7B. FIG. 12A is a diagram showing an aspect of the attack scenario display screen shown in FIG. 11A. FIG. 12B is a diagram showing an aspect of the attack scenario display screen shown in FIG. 11B. FIG. 13 is a flowchart showing the operation of the security monitoring system according to the embodiment. FIG. 14 is a flowchart showing the detailed operation of step S30 shown in FIG. FIG. 15 is a flowchart illustrating an example of attack estimation processing of the security monitoring system according to the embodiment. FIG. 16 is a diagram showing an example of a functional configuration of an attack analysis device according to another embodiment. FIG. 17 is a flowchart showing the operation of the attack analysis device according to another embodiment.

  Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. Note that the embodiments described below are merely examples, and the present disclosure is not limited by these embodiments. That is, all the embodiments described below show general or specific examples. Numerical values, shapes, materials, components, arrangement positions and connection forms of components, steps, order of steps, and the like shown in the following embodiments are merely examples, and are not intended to limit the present disclosure. Further, among the components in the following embodiments, components not described in the independent claim indicating the highest concept are described as arbitrary components.

  Further, each drawing is a schematic view, and is not necessarily illustrated exactly. Moreover, in each figure, the same code | symbol is attached | subjected about the same structural member.

Embodiment
[System 1]
FIG. 1 is a diagram showing an outline of a system 1 according to the present embodiment. FIG. 2 is a diagram showing an example of a functional configuration of the system 1 according to the present embodiment.

  A system 1 according to the present embodiment is a system for security monitoring that monitors an attack on an information processing device of one or more objects having a plurality of information processing devices connected by a first network.

  The system 1 includes a security monitoring system 10 and one or more mobile units (mobile units 110 and 120), as shown in FIGS. 1 and 2, for example. The security surveillance system 10 and one or more mobile units are connected by a network 20.

[Network 20]
The network 20 is an example of a second network, and is, for example, a public network such as the Internet. Further, the network 20 may be a virtual private network (VPN) which is a virtual in-house network established via a public line of a communication carrier.

[Mobile 110]
One or more mobile units have the same configuration. Therefore, the configuration of the mobile unit 110 will be described below.

  FIG. 3A is a diagram showing an example of a functional configuration of the mobile unit 110 according to the present embodiment. FIG. 3B is a diagram showing an aspect of the mobile unit 110 shown in FIG. 3A. In FIG. 3B, a car 110 a is shown as one aspect of the mobile body 110. FIG. 4A and FIG. 4B are diagrams showing an example of a log (mobile log) transmitted by the mobile 110 according to the present embodiment.

  The mobile unit 110 has a plurality of information processing apparatuses connected by a first network. For example, as shown in FIG. 2, the mobile 110 includes an information processing apparatus 111, an information processing apparatus 112, and an information processing apparatus 113, which are connected by a network 114.

  For example, as shown in FIG. 3B, the mobile object 110 is an automobile 110a to which a plurality of information processing apparatuses such as the IVI 111a, the GW 112a, the CAN 113a, and the ECUs 1131a and 1132a which are electronic control units connected to the CAN 113a are connected. It is.

  Mobile body 110 in the present embodiment is not limited to a car, and may be a ship, a vehicle such as an airplane, a drone, or the like. That is, mobile unit 110 in the present embodiment can be connected to a network such as the Internet, and the configuration and the like of a plurality of information processing devices included in mobile unit 110 can be known in design.

  The mobile object 110 is an example of one or more objects to be subjected to security monitoring of the system 1. In other words, the present disclosure is not limited to the moving object, and may be an object similar to the moving object. More specifically, one or more objects can be connected to a network such as the Internet as in a mobile object such as a car, and the configuration and the like of a plurality of information processing devices possessed by the objects can be known in design. Just do it.

  Examples of such an object include robots that have a plurality of actuators, such as industrial robots and construction robots, and can be connected to a network. Further, as such an object, there is an audiovisual system in which a plurality of digital devices (TV, VIDEO, audio devices, etc.) are connected via a network and can be connected to a network such as the Internet. Further, as such an object, there is a factory system in which a plurality of PLCs (Programmable Logic Controllers) are connected via a network and can be connected to a network such as the Internet.

  In the following, as an example of one or more objects, one or more moving objects will be described as an example.

<Network 114>
The network 114 is an example of a first network and is different from the network 20 which is a second network. For example, as shown in FIGS. 2 and 3A, the network 114 is one in which an information processing apparatus 111, an information processing apparatus 112, an information processing apparatus 113, etc. are connected by a network cable. The network 114 is a network in the mobile unit 110 that exchanges information on events generated in the mobile unit 110, and is hereinafter also referred to as a mobile network. The configuration of the network 114 shown in FIG. 2 and FIG. 3A is an example, and is not limited to this configuration.

  The network 114 may be, for example, an in-vehicle network 114a of a car 110a as shown in FIG. 3B.

<Information processing apparatus 111>
The information processing device 111 is one of a plurality of information processing devices included in the mobile object 110. The information processing apparatus 111 has a function capable of connecting to telematics or the Internet, a function for realizing an information element such as provision of information to a person boarding the mobile body 110, and a function for realizing an entertainment element for a person boarding the mobile body 110. . Further, the information processing apparatus 111 has a function capable of acquiring a log generated in the information processing apparatus 111 when these functions are realized.

  As shown in FIG. 3A, the information processing apparatus 111 has, for example, a log transmission unit 1111 and transmits a log (mobile log) generated in the information processing apparatus 111 to the security monitoring system 10 via the log transmission unit 1111. Do. More specifically, the log transmission unit 1111 determines the date and time of occurrence of an event (event) generated in the information processing apparatus 111 and the mobile object log content indicating the content of the event (content of the event) in the information processing apparatus 111. It transmits to the security monitoring system 10 as a mobile body log generated in the above. At that time, the log transmission unit 1111 is an ID (mobile log ID) for uniquely identifying occurrence date and time and mobile log contents, an ID (mobile ID) for uniquely identifying the mobile 110, and an information processing apparatus A name (or an ID) for uniquely identifying 111 is given and transmitted to the security monitoring system 10.

  The mobile log ID, the mobile ID, and the name (or ID) for uniquely identifying the information processing apparatus 111 may not be assigned by the information processing apparatus 111, but may be assigned on the security monitoring system 10 side. It is also good.

  Further, as shown in FIG. 3B, for example, the information processing apparatus 111 may be an IVI 111a, which is in-vehicle infotainment of the automobile 110a. The IVI 111a has, for example, a function to realize an entertainment element such as a car audio, a car DVD, a TV tuner, and a function to realize an information element such as a route guidance (car navigation system) and display of road traffic information. Furthermore, the IVI 111a transmits, to the security monitoring system 10, a log (mobile log) regarding an event (event) generated by executing these functions.

<Information processing apparatus 112>
The information processing device 112 is one of a plurality of information processing devices included in the mobile object 110. The information processing apparatus 112 has a function for realizing a function of communicating with the outside of the mobile unit 110, and a mobile unit such as a log generated by the information processing apparatus 111 when the function is realized and packets traversing the network 114. It has a function that can acquire network logs.

  Further, in the present embodiment, as shown in FIG. 3A, the information processing apparatus 112 includes, for example, a log transmission unit 1121, and the log transmission unit 1121 is used for the log (mobile log) generated in the information processing apparatus 112. It transmits to the security monitoring system 10 via.

  More specifically, the log transmission unit 1121 uses the information processing apparatus 112 to display the occurrence date and time of the event (event) generated in the information processing apparatus 112 and the mobile object log content indicating the event content (event content). It is transmitted to the security monitoring system 10 as a generated mobile log. At that time, the log transmission unit 1121 is an ID (mobile log ID) for uniquely identifying occurrence date and time and mobile log contents, an ID (mobile ID) for uniquely identifying the mobile 110, and an information processing apparatus A name (or an ID) for uniquely identifying 112 is given and transmitted to the security monitoring system 10. Mobile log contents may include mobile network logs.

  The mobile log ID, the mobile ID, and the name (or ID) for uniquely identifying the information processing apparatus 111 may not be assigned by the information processing apparatus 112, but may be assigned on the security monitoring system 10 side. It is also good.

  Further, as shown in FIG. 3B, for example, the information processing apparatus 112 may be a GW 112a which is a gateway for performing communication between the CAN 113a and the outside in the automobile 110a. The GW 112 a is a device that performs protocol conversion to communicate with the network 20 outside the automobile 110 a. The GW 112 a appropriately converts the protocol of the log related to packets traveling on and off the in-vehicle network 114 a and the logs transmitted by the other information processing apparatuses IVI 111 a, CAN 113 a and the ECUs 1131 a and 1132 a. The GW 112 a transmits a mobile body log obtained by converting these logs into a protocol to the security monitoring system 10 via the network 20.

  Here, the GW 112a, which is an example of the information processing apparatus 112, may transmit a mobile log generated by the information processing apparatus 112 as shown in FIG. 4A or 4B to the security monitoring system 10. That is, when the event (event) is a firmware update of the GW 112a, as shown in FIG. 4A, “firm update success” indicating that the event is successful and the log is normal as shown in FIG. 4A. The mobile object log may be sent to the security monitoring system 10. Also, as shown in FIG. 4B, even if a mobile log including “Farm unauthorized rewrite” indicating that the event has failed and is an abnormal log is transmitted to the security monitoring system 10 in the mobile log contents. Good.

<Information processing device 113>
The information processing device 113 is one of a plurality of information processing devices included in the mobile object 110. The information processing apparatus 113 has a function capable of communicating with the information processing apparatus 112, and is further connected to an information processing apparatus group capable of controlling a drive system such as an actuator of the moving body 110.

  The information processing apparatus 113 has a function of communicating with an information processing apparatus group capable of controlling a drive system and the like, acquiring a log from the information processing apparatus group, and transmitting the log to the information processing apparatus 112. Further, the information processing apparatus 113 has a function capable of acquiring a log generated by the information processing apparatus 113 when these functions are realized.

  In the present embodiment, as shown in FIG. 3A, the information processing apparatus 113 includes, for example, a log transmission unit 1131, and the log (mobile log) generated by the information processing apparatus 113 is transmitted via the log transmission unit 1131. Send to the security monitoring system 10.

  The mobile body log transmitted by the log transmission unit 1131 to the security monitoring system 10 is the same as the log transmission unit 1111 and the like, and thus the description thereof is omitted.

  Further, as shown in FIG. 3B, for example, the information processing apparatus 113 is an information processing apparatus that configures CAN (Controller Area Network) of an ECU (Electronic Control Unit) group that performs traveling control of the automobile 110a including engine control. It may be CAN 113a. The ECU group is an example of the above-described information processing device group. Further, the ECU group is, for example, a control device capable of electronically controlling transmission control and brake control in addition to engine control.

  The CAN 113a serially connects the respective systems and sensors that constitute the on-vehicle application of the automobile 110a. In the example shown in FIG. 3B, the CAN 113a is serially connected to the ECU group such as the ECU 1131a and the ECU 1132a, and transmits the log generated by the ECU 1131a and the ECU 1132a or the log generated by the CAN 113a to the GW 112a as a mobile log. Send to system 10

  In the mobile object 110, each of the information processing apparatuses 111 to 113 may transmit the mobile object log to the security monitoring system 10. Further, in the moving object 110, the information processing apparatus 112 may collectively transmit moving object logs of the information processing apparatus 111 to the information processing apparatus 113 to the security monitoring system 10 at regular intervals.

[Security monitoring system 10]
Next, the configuration of the security monitoring system 10 will be described.

  The security monitoring system 10 is a system that performs security monitoring, and monitors an attack on an information processing apparatus of one or more objects having a plurality of information processing apparatuses connected by a first network. The security monitoring system 10 includes, for example, as shown in FIG. 5, a mobile log DB 11, an attack analysis device 12, an analysis support information DB 13, an attack log DB 14, and a display 15.

<Mobile log DB 11>
The mobile log DB 11 is obtained from each of one or more mobiles via a second network different from the first network, thereby generating logs (mobiles generated in each of a plurality of information processing apparatuses included in one or more objects). Log) is stored in the first storage unit.

  In the example illustrated in FIGS. 2 and 5, the mobile log DB 11 stores mobile logs acquired from the mobile 110 and the mobile 120 via the network 20 different from the network 114. The mobile log DB 11 is connected to the attack analysis device 12 and has a function of providing the stored mobile log to the attack analysis device 12.

  Mobile body log DB 11 stores logs (mobile body log) in a data format as shown in, for example, FIGS. 4A and 4B. The mobile body log may include mobile body log contents indicating a system log, a security log, and a network log, in addition to the examples shown in FIGS. 4A and 4B.

  In the example shown in FIGS. 2 and 5, the mobile log DB 11 is connected to the attack analysis apparatus 12 via the network of the security monitoring system 10, but the present invention is not limited to this. The mobile log DB 11 may be connected to the attack analysis device 12 via the network 20.

  Further, FIG. 2 shows an example in the case where the mobile log DB 11 stores the mobile log acquired from each of the mobile 110 and the mobile 120 via the network 20 by the attack analysis device 12. But it is not limited to this. The mobile body log DB 11 may store the mobile body log acquired from each of the mobile body 110 and the mobile body 120 via the network 20 by itself. In addition, the mobile log DB 11 may constitute a cloud and may be an apparatus independent of the attack analysis apparatus 12.

<Attack analysis device 12>
The attack analysis device 12 is a device for analyzing whether or not one mobile unit has been attacked via a plurality of information processing devices.

  FIG. 5 is a diagram showing an example of a functional configuration of the attack analysis device 12 according to the present embodiment.

  As shown in FIG. 5, the attack analysis device 12 includes a log collection unit 121, an attack determination unit 122, and an attack scenario display generation unit 123.

«Log collection unit 121»
The log collection unit 121 collects logs of one or more moving objects having a plurality of information processing apparatuses. In the example illustrated in FIG. 5, the log collection unit 121 acquires a mobile body log from each of the mobile body 110 and the mobile body 120 via the network 20, and stores the mobile body log in the mobile body log DB 11.

  For example, as shown in FIGS. 4A and 4B, the log collection unit 121 may collect all mobile logs of one or more mobiles including normal logs and non-normal logs, and the log collection unit 121 is shown in FIG. 4B. Only non-normal mobile logs may be collected.

«Attack determination unit 122»
The attack determination unit 122 is an example of an attack determination device. The attack determination unit 122 is an analysis support information regarding a plurality of information processing apparatuses included in one object, which are two or more logs of one object stored in the first storage device and analysis support information stored in the second storage device. Contrast with the information. The attack determination unit 122 determines whether or not each of the two or more logs is an attack on the information processing apparatus corresponding to each of the two or more logs by comparing in this way, and outputs the determination result.

  More specifically, the attack determination unit 122 extracts analysis support information on an information processing apparatus corresponding to each of the two or more logs from the analysis support information stored in the second storage device. Then, by comparing the two or more logs with the extracted analysis support information, the attack determination unit 122 determines whether the event indicated in each of the two or more logs is an event that occurs in the corresponding information processing apparatus. Whether or not it is an attack on the information processing apparatus corresponding to each of the two or more logs is determined depending on whether or not it is.

  For example, the analysis support information is configured of an occurrence condition of an event described in each of two or more logs, and determination information indicating a condition for identifying whether the occurrence condition is correct. In this case, the attack determination unit 122 extracts information for determining whether or not the condition indicated in the determination information is satisfied from each of the two or more logs, and compares it with the determination information to determine whether it is an attack or not. It may be determined. The attack determination unit 122 extracts features from each of the two or more logs, and extracts the information from each of the two or more logs by using the extracted information as information for determining statistical information of the features. It is also good.

  In the example illustrated in FIGS. 2 and 5, the attack determination unit 122 acquires, for example, two or more mobile logs of the mobile 110 from the mobile log DB 11, and the information processing apparatus 111 included in the mobile 110 from the analysis support information DB 13. Extract analysis support information including design information on .about.113. The attack determination unit 122 associates two or more mobile object logs with the extracted analysis support information, thereby causing an event indicated in each of the two or more mobile object logs to occur in the corresponding information processing apparatus. Determine if it is. Then, if it is determined that the event indicated in the mobile object log is not an event that occurs in design, the attack determination unit 122 determines that a hacker is attacked on the corresponding information processing apparatus, and the determination result The attack log DB 14 is stored with the attack determination content which is the attack content estimated as

  Note that the candidate for the attack determination content, that is, the attack determination content candidate may be included in the analysis support information extracted from the analysis support information DB 13 or may be estimated from the analysis support information. Further, the determination result is not limited to the case of indicating the attack determination content, and may indicate the possibility of attacking the moving object 110 or the abnormality degree of a plurality of information processing apparatuses included in the moving object 110.

  FIG. 6 is a diagram showing an example of analysis support information extracted by the attack determination unit 122 according to the present embodiment.

  In FIG. 6, the attack determination unit 122 acquires the mobile log including the abnormal log of the mobile log ID “E0001” shown in FIG. 4B and processes the information processing of the mobile 110 corresponding to the mobile log ID “E0001”. An example of extracting analysis support information of the apparatus 112 is shown. The analysis support information shown in FIG. 6 is composed of the occurrence condition of the event shown in the mobile body log contents and its judgment information. Further, FIG. 6 further shows attack determination content candidates that can be determined using the extracted analysis support information.

  In FIG. 6, the occurrence condition “within the firmware update period” indicates the occurrence condition of the event shown in the mobile log contents obtained from the design information of the information processor 112 of the mobile 110, and the information processor 112 It is set and fixed. Further, the determination information “in period or out of period” indicates a condition for identifying whether or not the occurrence condition is correct, and whether or not it is an event that occurs in design in the information processing apparatus 112 of the mobile object 110 It corresponds. The determination information is static or dynamic acquired from a mobile log or the like.

  Then, the attack determination unit 122 compares the analysis support information illustrated in FIG. 6 with the moving body log illustrated in FIG. 4B, and thereby the information processing device 112 corresponding to the event illustrated in the moving body log illustrated in FIG. 4B. To determine if it is an event that occurs on design. When it is determined that the event shown in the mobile object log shown in FIG. 4B does not occur in design, the attack determination unit 122 determines that a hacker attack is being performed on the corresponding information processing apparatus. Then, the attack determination unit 122 may estimate that the attack is the attack determination content such as “firmware unauthorized rewrite”.

  In addition, the attack determination unit 122 acquires logs of two or more moving objects online, that is, in real time, and determines whether an event indicated in each of the two or more moving object logs is an event that occurs in design in the corresponding information processing apparatus May be determined. In addition, the attack determination unit 122 may obtain two or more mobile body logs, and determine whether an event indicated in each of the two or more mobile body logs is an event that occurs in design off-line.

  The attack determination unit 122 may not be able to determine whether the event indicated in each of the one or more moving object logs among the two or more moving object logs is an event that occurs in design in the corresponding information processing apparatus. . In this case, if the attack determination unit 122 determines that the attack is not an event that occurs in design in the corresponding information processing apparatus in the other mobile log other than the one or more mobile log. It may be determined that an attack is indicated also in an event indicated in the one or more mobile object logs. Then, the attack determination unit 122 may estimate an event indicated in the one or more mobile object logs as an attack indicated in the attack determination content candidate.

  That is, if the attack determination unit 122 determines that one or more of the two or more logs is an attack on the information processing apparatus corresponding to the one or more logs, at least one of the two or more logs. When it can not be determined that one log is an attack on the information processing apparatus corresponding to the at least one log, it is presumed that the at least one log is an attack on the information processing apparatus corresponding to the at least one log. Just do it.

«Attack scenario display generation unit 123»
It is assumed that the attack determination unit 122 determines that each of the two or more logs is an attack on the information processing apparatus corresponding to each of the two or more logs. In this case, the attack scenario display generation unit 123 is a display screen that displays the determined attack content (attack determination content) and the time when each of the two or more logs is generated at a position corresponding to the two or more logs. Generate and output attack scenario display screen.

  For example, as the attack scenario display screen, the attack scenario display generation unit 123 uses the first network that the one object has, as the attack scenario display screen, the determined attack content (attack determination content) and the time when each of two or more logs is generated. A display screen associated with the position of the corresponding information processing device in the object network configuration diagram showing a plurality of connected information processing devices may be generated and output. In addition, for example, the attack scenario display generation unit 123 sets, as an attack scenario display screen, the determined attack content (attack determination content) and the information processing apparatus corresponding to each of the two or more logs as two or more logs. A display screen displayed in chronological order may be generated and output for each time when each occurs.

  In addition, the attack scenario display generation unit 123 outputs the generated attack scenario display screen on the display and causes the display to display.

  FIGS. 7A and 7B are diagrams showing an example of the attack scenario display screen generated by the attack scenario display generation unit 123 according to the present embodiment. In FIG. 7A, an example of an attack scenario display screen including a mobile network showing the information processing apparatuses 111 to 113 of the mobile 110 is shown. FIG. 7B shows an example of an attack scenario display screen including a timeline.

  That is, as shown in FIG. 7A, the attack scenario display generation unit 123 determines the attack determination content and the time when each of the three mobile logs is generated at the position of the corresponding information processing apparatus in the mobile network of the mobile 110. The associated attack scenario display screen may be generated. Further, as shown in FIG. 7B, the attack scenario display generation unit 123 corresponds to the attack determination content and each of the three moving object logs in time series for each time when each of the three logs such as time A, B, and C occurs. An attack scenario display screen displaying the information processing apparatuses 111 to 113 may be generated.

  For example, in the attack scenario display screen shown in FIG. 7A and FIG. 7B, there may be considered a case where there is a moving object log for which attack determination has not been made yet. In this case, the attack scenario display generation unit 123 can color-code the screen corresponding to the moving object log and the screen corresponding to another moving object log to find out that there is no problem with no attack determination. Such attack scenario display screen may be generated.

  In addition, although the case where the attack analysis device 12 includes the log collection unit 121, the attack determination unit 122, and the attack scenario display generation unit 123 has been described using the example illustrated in FIG. 5, the present invention is not limited thereto. The log collection unit 121, the attack determination unit 122, and the attack scenario display generation unit 123 may be independent devices, that is, a log collection device, an attack determination device, and an attack scenario display generation device, and each of the cloud It may be configured.

<Analysis support information DB 13>
The analysis support information DB 13 is analysis support information used to determine an attack on each of a plurality of information processing devices that are one or more objects, and stores analysis support information including at least design information on each of the plurality of information processing devices A second storage device. Here, the analysis support information may include at least design information on each of the plurality of information processing apparatuses, and the analysis support information may further include specifications of one or more objects and states of one or more objects. . The analysis support information is configured of an occurrence condition of an event described in each of two or more logs, and determination information indicating a condition for identifying whether the occurrence condition is correct.

  More specifically, the analysis support information DB 13 stores, for example, analysis support information including the occurrence condition and the determination information as described with reference to FIG.

  The generation condition indicates a generation condition of a log obtained from design information set in advance in an information processing apparatus corresponding to a mobile log, and is fixed. The determination information may include, for example, mobile specification such as a network configuration of a mobile. In addition, the generation condition may include sequence information on firmware update of the information processing apparatus, or state transition information of a moving object such as transition from parking to traveling, transition from traveling to lane keep mode, etc. Good.

  The determination information indicates a condition for identifying whether or not the occurrence condition is correct, and is used to determine whether or not the event occurs in design in the information processing apparatus corresponding to the mobile log. As described above, the determination information is dynamic information acquired from a mobile log or the like. The determination information may include the system state of the mobile such as in the automatic operation mode or in the lane keeping state. In addition, the determination information may include the traveling state of the moving body such as the moving body traveling or at rest.

  The analysis support information is not limited to the one described in FIG. The analysis support information DB 13 may store analysis support information as shown in FIG.

  FIG. 8 is a diagram showing an example of analysis support information stored in the analysis support information DB 13 according to the present embodiment. FIG. 8 shows attack determination content candidates which can be estimated by comparing the analysis support information corresponding to the mobile body log contents with the analysis support information and the mobile body log contents.

  Note that, in FIG. 8, there is one in which “No (cannot be determined)” is indicated in the analysis support information corresponding to the specific mobile log content. It is determined whether an event indicated in a specific moving object log content indicates an attack, even if the specific moving object log content is compared with design information of an information processing apparatus or the like corresponding to the moving object log content. It shows that it can not. In this case, when the attack determination unit 122 determines that an event indicated in another mobile object log is indicated to be attacked, the event indicated in the specific mobile object log is determined as an attack determination content. It can be estimated that the attack shown in the candidate is being done.

<Attack log DB 14>
The attack log DB 14 is a third storage device that stores an attack log including attack determination contents determined to be an attack on a mobile body. The attack log DB 14 stores attack logs corresponding to two or more mobile body logs for each mobile body.

  More specifically, the attack log DB 14 stores the attack determination content determined by the attack determination unit 122 and information for uniquely identifying the corresponding mobile log.

  FIG. 9 is a diagram showing an example of an attack log stored by the attack log DB 14 according to the present embodiment.

  In FIG. 9, as shown in FIG. 4B by the attack determination unit 122, the event indicated by “firmware update failure” which is the mobile object log content is an attack of “firmware unauthorized rewrite” on the information processing apparatus 112 of the mobile object 110. An example is shown when it is determined that That is, in the attack log DB 14, a mobile ID, an information processing apparatus name, an event (event) occurrence date and time, and an attack determination content "firm unauthorized rewrite" are described as information for uniquely identifying a mobile log. An example of the case is shown. Although the attack log illustrated in FIG. 9 illustrates an example including the moving object ID, the information processing device name, and the occurrence date and time as information for uniquely identifying the moving object log, the present invention is not limited thereto.

  Moreover, in the example shown to FIG. 2 and FIG. 5, although mobile log DB11 is connected with the attack analysis apparatus 12 via the network which the security monitoring system 10 has, it does not restrict to this. The attack log DB 14 may be connected to the attack analysis device 12 via the network 20. The attack log DB 14 may itself acquire the attack determination content determined by the attack determination unit 122 and the corresponding mobile log from the attack analysis device 12 via the network 20 and store it as an attack log. In addition, the attack log DB 14 may constitute a cloud and may be an apparatus independent of the attack analysis apparatus 12.

<Display device 15>
FIGS. 10A and 10B are diagrams showing an aspect of the attack scenario display screen displayed on the display device 15 according to the present embodiment. FIG. 11A is a diagram showing analysis support information used to estimate the attack determination content of the attack scenario display screen shown in FIG. 7A. FIG. 11B is a view showing analysis support information used to estimate the attack determination content of the attack scenario display screen shown in FIG. 7B.

  The display device 15 is an example of a display. The display device 15 has a display unit such as a display, and displays the attack scenario display screen generated by the attack scenario display generation unit 123. The display device 15 displays an attack scenario display screen as shown, for example, in FIGS. 7A and 7B.

  Here, for example, the display device 15 may display an attack scenario display screen as illustrated in, for example, FIGS. 10A and 10B. That is, when the mobile object 110 is the automobile 110a, the display device 15 determines the attack on the positions of the IVI 111a, the GW 112a and the CAN 113a, which are information processing devices corresponding in the onboard network of the automobile 110a, as shown in FIG. You may display the attack scenario display screen which matched the content and the time which each of three log generate | occur | produced. Further, as shown in FIG. 10B, the display device 15 is an information processing apparatus corresponding to attack determination contents and each of the three logs in time series for each time when each of the three logs such as time A, B and C is generated. You may display the attack scenario display screen which displayed a certain IVI111a, GW112a, and CAN113a.

  In FIG. 7A and FIG. 7B, although it is described that the attack determination content is shown on the attack scenario display screen, the present invention is not limited to this. The analysis support information used to estimate the attack determination content of the attack scenario display screen may be further displayed. For example, the attack scenario display screen of FIGS. 7A and 7B is switched by an operation by a user such as an analyst using the display device 15, and the attack determination content of the attack scenario display screen is estimated as shown in FIGS. 11A and 11B. The analysis support information used to do this may be displayed.

  FIG. 12A is a diagram showing an aspect of the attack scenario display screen shown in FIG. 11A. FIG. 12B is a diagram showing an aspect of the attack scenario display screen shown in FIG. 11B. That is, when the moving body 110 is the automobile 110a, the display device 15 determines the attack on the positions of the IVI 111a, the GW 112a and the CAN 113a, which are information processing devices corresponding to the onboard network of the automobile 110a, as shown in FIG. 12A. An attack scenario display screen is displayed in which the analysis support information used to estimate the content is associated with the time when each of the three mobile body logs is generated. Further, as shown in FIG. 12B, the display device 15 is analysis support information used to estimate the attack determination content in time series for each time when three mobile object logs such as time A, B and C are generated. And an attack scenario display screen on which the IVI 111a, the GW 112a, and the CAN 113a, which are information processing apparatuses respectively corresponding to the three mobile object logs, are displayed.

  Thus, it is assumed that the analysis support information used to estimate the attack determination content of the attack scenario display screen is displayed as shown in FIGS. 12A and 12B by switching the attack scenario display screens in FIGS. 10A and 10B. It is also good.

  The display device 15 may be a PC or the like having a display unit. In this case, the display device 15 may function as a terminal and operate the attack analysis device 12 to cause the attack analysis device 12 to monitor an attack on a mobile having a plurality of information processing devices.

[Operation of security monitoring system 10]
Next, the operation of the security monitoring system 10 configured as described above will be described using the drawings.

  FIG. 13 is a flowchart showing the operation of the security monitoring system 10 according to the present embodiment.

  First, the security monitoring system 10 stores a log (mobile log) acquired from one or more mobiles (S10). More specifically, the security monitoring system 10 stores, in the first storage device, logs generated by each of a plurality of information processing apparatuses possessed by one or more objects acquired from each of one or more objects via the network. For example, in the example illustrated in FIG. 2, the security monitoring system 10 stores the mobile body log acquired from each of the mobile body 110 and the mobile body 120 in the mobile body log DB 11 via the network 20.

  Next, the security monitoring system 10 extracts analysis support information for each of one or more mobile units (S20). More specifically, the security monitoring system 10 is analysis support information used to determine an attack on each of a plurality of information processing apparatuses included in one or more objects, and the analysis support information on each of the plurality of information processing apparatuses is Extract from the second storage device. For example, in the example illustrated in FIG. 2, the security monitoring system 10 extracts analysis support information including the occurrence condition and the determination information from the analysis support information DB 13.

  Next, the security monitoring system 10 performs attack determination using the mobile body log for one mobile body and the corresponding analysis support information (S30). More specifically, the security monitoring system 10 first includes two or more logs of one object stored in the first storage device, and analysis support information extracted in step S20, and has a plurality of objects of the one object. By comparing the analysis support information on the information processing apparatus, it is determined whether or not each of the two or more logs is an attack on the information processing apparatus corresponding to each of the two or more logs. For example, in the example illustrated in FIG. 2, the security monitoring system 10 displays the analysis support information stored in the analysis support information DB 13 and the mobile body log stored in the mobile body log DB 11 in the mobile body log. It is determined whether the event is an event that occurs in design in the corresponding information processing apparatus.

  Hereinafter, step S30 will be described in more detail with reference to FIG.

  FIG. 14 is a flowchart showing the detailed operation of step S30 shown in FIG.

  That is, in step S30, first, the security monitoring system 10 acquires a mobile object log for one mobile object (S301). More specifically, the security monitoring system 10 acquires two or more logs of one object stored in the first storage device. For example, in the example illustrated in FIG. 2, the security monitoring system 10 acquires two or more mobile body logs stored in the mobile body log DB 11.

  Next, the security monitoring system 10 extracts analysis support information corresponding to the acquired mobile log (S302). More specifically, the security monitoring system 10 adds each of the two or more logs acquired from the analysis support information stored in the second storage device, that is, from the analysis support information extracted from the second storage device in step S20. Analysis support information on a corresponding information processing apparatus is extracted. For example, in the example illustrated in FIG. 2, the security monitoring system 10 extracts analysis support information corresponding to the acquired two or more mobile body logs from the analysis support information stored in the analysis support information DB 13.

  Next, the security monitoring system 10 determines, for each of the two or more mobile logs, whether the event indicated by the mobile log is an event that occurs in design (S303). More specifically, the security monitoring system 10 compares the acquired two or more logs with the analysis support information extracted in step S302 to process the information processing corresponding to the event indicated in each of the two or more logs. Whether it is an attack on an information processing apparatus corresponding to each of two or more logs is determined according to whether or not it is an event that occurs in design in the apparatus. For example, in the example illustrated in FIG. 2, the security monitoring system 10 processes the information indicated by each of the two or more mobile logs by correlating the two or more mobile logs with the extracted analysis support information. Determine whether it is an event that occurs in design in the device.

  In step S303, if the event indicated by the mobile object log is not an event that occurs in design (No in S303), it is determined that the event indicated in the mobile object log is an attack (S304). On the other hand, if the event indicated by the mobile object log is an event that occurs in design (Yes in S303), it is determined that the event indicated in the mobile object log is not an attack (S305). That is, for example, in the example shown in FIG. 2, the security monitoring system 10 associates two or more mobile body logs with the extracted analysis support information to design an event shown in each of the two or more mobile body logs in design. Whether it is an attack on a mobile by a hacker is determined based on whether or not it is an event that occurs.

  In step S303, it may not be possible to determine whether the event indicated by the mobile object log is an event that occurs in design. That is, there are cases where it can not be determined from the analysis support information corresponding to the log whether the event indicated by the mobile body log is an event that occurs in design. In this case, in the attack log stored in the attack log DB 14, there is a mobile body log that is not determined to be attacked.

  The operation of the security monitoring system 10 in this case will be described with reference to FIG.

  FIG. 15 is a flowchart showing an example of the attack estimation process of the security monitoring system 10 according to the present embodiment.

  It is assumed that the security monitoring system 10 performs the attack determination process shown in FIG. 13 and stores the attack log in the attack log DB 14.

  Thereafter, as shown in FIG. 14, the security monitoring system 10 first acquires an attack log from the attack log DB 14 (S306).

  Next, the security monitoring system 10 determines whether there is a moving object log for which the attack determination can not be made in the same moving object (S307).

  If there is a mobile log for which the attack determination can not be made (yes in S307), it is determined whether the mobile log is within a predetermined period before and after the other log determined to be attacked (S308).

  If it is within a predetermined period before and after another log (Yes in S308), it is determined that the event indicated in the mobile object log is an attack (S309).

  Note that the predetermined period in step S308 may be changed according to the number of transits from the I / F (interface) outside the mobile unit. For example, if the number of passes is 10 or more, the period may be extended.

[Effects, etc.]
According to the system and method of the present embodiment, it is possible to determine whether or not an attack via a plurality of information processing apparatuses has been performed in one mobile object by using the mobile object log and the analysis support information. Therefore, it is possible to monitor an attack on the information processing apparatus of a mobile having a plurality of information processing apparatuses.

  Furthermore, the system and method of the present embodiment provide an attack scenario display screen that displays both the determined attack determination content and the log acquisition time. This enables the analyst to estimate an attack scenario for one mobile unit.

  As described above, the system and method of the present embodiment can be applied not only to mobiles but also to objects similar to mobiles. That is, according to the system and method of the present embodiment, it is possible to monitor an attack on a data processing device of a mobile having a plurality of data processing devices.

  In addition, the system and method of the present embodiment provide an attack scenario display screen that displays both the determined attack determination content and the log acquisition time. This enables the analyst to estimate an attack scenario for one object.

(Other embodiments)
Although the above-mentioned embodiment explained that analysis support information was beforehand stored in analysis support information DB13, it does not restrict to this. The attack analysis device may newly register new analysis support information using the mobile body log collected by the log collection unit 121.

  FIG. 16 is a diagram showing an example of a functional configuration of the attack analysis device 12A according to another embodiment. The same elements as in FIG. 5 are denoted by the same reference numerals, and the detailed description will be omitted.

  The attack analysis device 12A shown in FIG. 16 is different in configuration from the attack analysis device 12 shown in FIG. 5 in that a judgment information generation unit 124 is added.

  The determination information generation unit 124 acquires the mobile body log collected by the log collection unit 121.

  In addition, the determination information generation unit 124 determines whether analysis support information corresponding to the acquired moving object log is stored in the analysis support information DB 13.

  When it is determined that the analysis support information corresponding to the acquired moving object log is stored in the analysis support information DB 13, the determination information generation unit 124 increments the collection number of the corresponding analysis support information by one. On the other hand, when the determination information generation unit 124 determines that the analysis support information corresponding to the acquired mobile log is not stored in the analysis support information DB 13, it analyzes the analysis support information corresponding to the mobile log. It newly registers in support information DB13.

  Although it has been described that the determination information generation unit 124 adds new analysis support information when there is no analysis support information corresponding to the acquired mobile log in the analysis support information DB 13 in the analysis support information DB 13, the present invention is not limited thereto. For example, even when the determination information generation unit 124 acquires the movement pair log, even if the analysis support information that is already stored in the analysis support information DB 13 and that corresponds to the acquired moving object log is updated. Good. In addition, the determination information generation unit 124 may perform an update process of adding new analysis support information only when a predetermined number of mobile object logs without analysis support information are acquired.

  Next, the operation of the attack analysis device 12A configured as described above will be described.

  FIG. 17 is a flowchart showing the operation of the attack analysis device 12A according to another embodiment.

  First, the attack analysis device 12A acquires a mobile log (S40). More specifically, the attack analysis apparatus 12A acquires the log collection unit 121 by collecting mobile object logs.

  Next, the attack analysis device 12A determines whether there is analysis support information corresponding to the moving object log acquired in S40 in the analysis support information DB (S50). More specifically, the attack analysis device 12A causes the determination information generation unit 124 to determine whether or not analysis support information corresponding to the acquired mobile log is stored in the analysis support information DB 13.

  In step S50, when it is determined that there is (Yes in S50), the attack analysis device 12A increments the count number of the corresponding analysis support information by one. On the other hand, if it is determined that there is not (No in S50), the attack analysis device 12A newly registers the corresponding analysis support information in the analysis support information DB 13. More specifically, if the attack analysis device 12A determines that the analysis support information corresponding to the acquired mobile log is stored in the analysis support information DB 13, the determination information generation unit 124 At 124, the collection number of corresponding analysis support information is incremented by one. On the other hand, when the attack analysis device 12A determines that the analysis support information corresponding to the acquired mobile log is not stored in the analysis support information DB 13, the judgment information generation unit 124 The analysis support information corresponding to the mobile body log is newly registered in the analysis support information DB 13.

  As described above, the embodiment has been described as an example of the technology disclosed in the present application. However, the technology in the present embodiment is not limited to this, and can be applied to an embodiment in which changes, replacements, additions, omissions, and the like are appropriately made. Moreover, it is also possible to combine each component demonstrated by said each embodiment, and to set it as a new embodiment.

  Further, although the embodiments according to the present disclosure have been described in detail with reference to the drawings, the functions of the above-described apparatus and each processing unit may be realized by a computer program.

  The computer that realizes the functions described above according to a program includes input devices such as a keyboard and a mouse or a touch pad, output devices such as a display and a speaker, a processor or central processing unit (CPU), read only memory (ROM), and random access memory (RAM) Memory, a storage device such as a hard disk drive or solid state drive (SSD), a reader that reads information from a recording medium such as a DVD-ROM (Digital Versatile Disk Read Only Memory) or a USB (Universal Serial Bus) memory, via a network A network card or the like for communication is provided, and each unit is connected by a bus.

  Then, the reading device reads the program from the recording medium having the program recorded thereon, and stores the program in the storage device. Alternatively, the network card communicates with the server device connected to the network, and stores in the storage device a program for realizing the functions of the respective devices downloaded from the server device.

  Then, the processor or the CPU copies the program stored in the storage device to the RAM, sequentially reads out the instructions included in the program from the RAM, and executes the instructions, whereby the functions of the above-described devices are realized.

  The system and method according to the present disclosure can be used in a system and method for security surveillance for monitoring hacker attacks on information processing devices possessed by mobile objects such as cars, ships and airplanes.

1 System 10 Security Monitoring System 11 Mobile Object Log DB
12 Attack Analysis Device 13 Analysis Support Information DB
14 Attack Log DB
REFERENCE SIGNS LIST 15 display device 20, 114 network 110, 120 mobile unit 110 a automobile 111, 112, 113 information processing apparatus 111 a IVI
112a GW
113a CAN
121 Log Collection Unit 122 Attack Determination Unit 123 Attack Scenario Display Generation Unit 1111, 1121, 1131 Log Transmission Unit 1131a, 1132a ECU

Claims (13)

A system for security monitoring that monitors an attack on an information processing device of one or more objects having a plurality of information processing devices connected by a first network, the system comprising:
A first storage device for storing logs generated in each of a plurality of information processing apparatuses possessed by the one or more objects by being acquired from each of the one or more objects via a second network different from the first network; ,
A second storage device storing analysis support information related to each of the plurality of information processing apparatuses, which is analysis support information used to determine an attack on each of the plurality of information processing apparatuses included in the one or more objects;
Two or more logs of one object stored by the first storage device, and analysis support information stored in the second storage device, the analysis support information related to a plurality of information processing devices included in the one object By contrast, it is determined whether or not each of the two or more logs is an attack on an information processing apparatus corresponding to each of the two or more logs, and the attack determination apparatus outputs the determination result.
system. The analysis support information includes at least design information on each of the plurality of information processing devices.
The system of claim 1. The analysis support information further includes a specification of each of the one or more objects and a state of each of the one or more objects.
The system of claim 2. The analysis support information includes an occurrence condition of an event described in each of the two or more logs, and determination information indicating a condition for identifying whether the occurrence condition is correct.
A system according to claim 2 or 3. The attack determination apparatus extracts, from each of the two or more logs, information for determining whether or not the condition indicated in the determination information is satisfied, and whether the attack is the attack by comparing with the determination information Determine whether or not
The system of claim 4. The attack determination device extracts a feature from each of the two or more logs, and uses the extracted statistical information of the feature as the information for the determination to extract the information from each of the two or more logs. ,
The system according to claim 5. The attack determination apparatus extracts analysis support information on an information processing apparatus corresponding to each of the two or more logs from the analysis support information stored in the second storage device.
By comparing the two or more logs with the extracted analysis support information, whether the event indicated in each of the two or more logs is an event that occurs in design in the corresponding information processing apparatus It is determined whether the attack is on an information processing apparatus corresponding to each of the two or more logs.
The system according to any one of claims 1 to 6. The attack determination device determines that at least one of the two or more logs is an attack on an information processing device corresponding to the one or more logs, at least one of the two or more logs. When it can not be determined that one log is an attack on the information processing apparatus corresponding to the at least one log, the at least one log is estimated to be an attack on the information processing apparatus corresponding to the at least one log. ,
A system according to any one of the preceding claims. further,
If it is determined by the attack determination apparatus that each of the two or more logs is an attack on an information processing apparatus corresponding to each of the two or more logs, the determined attack content and each of the two or more logs And an attack scenario display generation device for generating an attack scenario display screen which is a display screen for displaying the time when the event occurred and the position corresponding to the two or more logs,
The attack scenario display generation device outputs the generated attack scenario display screen on a display,
A system according to any one of the preceding claims. The attack scenario display generation device is connected as the attack scenario display screen by the first network that the one object has, the determined attack content and the time when each of the two or more logs is generated. Outputting a display screen associated with the position of the corresponding information processing device in the object network configuration diagram showing the plurality of information processing devices;
The system of claim 9. The attack scenario display generation device generates, as the attack scenario display screen, time at which each of the two or more logs generates the determined attack content and an information processing device corresponding to each of the two or more logs. Output the display screen displayed in chronological order every time,
The system of claim 9. further,
Said one or more objects,
The attack determination device and the one or more objects are connected by the second network,
A system according to any one of the preceding claims. A security monitoring method for monitoring an attack on an information processing device of one or more objects having a plurality of information processing devices connected by a first network, comprising:
A log generated in each of a plurality of information processing apparatuses possessed by the one or more objects is stored in the first storage device by being acquired from each of the one or more objects via a second network different from the first network. Memory step,
Analysis support information from a second storage device storing analysis support information related to each of the plurality of information processing devices, which is analysis support information used to determine an attack on each of the plurality of information processing devices included in the one or more objects An extraction step of extracting
The two or more logs of one object stored in the first storage device are compared with the analysis support information extracted in the extraction step and related to a plurality of information processing apparatuses included in the one object. Determining whether each of the two or more logs is an attack on the information processing apparatus corresponding to each of the two or more logs, and outputting a determination result.
Method.

Images